5 files changed, 61 insertions, 16 deletions
diff --git a/app/models/ci/resource_group.rb b/app/models/ci/resource_group.rb
index b788e4f58c1..a220aa7bb18 100644
--- a/app/models/ci/resource_group.rb
+++ b/app/models/ci/resource_group.rb
@@ -29,13 +29,19 @@ module Ci
         partition_id: processable.partition_id
       }
 
-      resources.free.limit(1).update_all(attrs) > 0
+      success = resources.free.limit(1).update_all(attrs) > 0
+      log_event(success: success, processable: processable, action: "assign resource to processable")
+
+      success
     end
 
     def release_resource_from(processable)
       attrs = { build_id: nil, partition_id: nil }
 
-      resources.retained_by(processable).update_all(attrs) > 0
+      success = resources.retained_by(processable).update_all(attrs) > 0
+      log_event(success: success, processable: processable, action: "release resource from processable")
+
+      success
     end
 
     def upcoming_processables
@@ -72,5 +78,14 @@ module Ci
       # belong to the same resource group are executed once at time.
       self.resources.build if self.resources.empty?
     end
+
+    def log_event(success:, processable:, action:)
+      Gitlab::Ci::ResourceGroups::Logger.build.info({
+        resource_group_id: self.id,
+        processable_id: processable.id,
+        message: "attempted to #{action}",
+        success: success
+      })
+    end
   end
 end
diff --git a/app/models/concerns/has_user_type.rb b/app/models/concerns/has_user_type.rb
index b02c95c9662..752be378ab0 100644
--- a/app/models/concerns/has_user_type.rb
+++ b/app/models/concerns/has_user_type.rb
@@ -15,7 +15,8 @@ module HasUserType
     security_bot: 8,
     automation_bot: 9,
     admin_bot: 11,
-    suggested_reviewers_bot: 12
+    suggested_reviewers_bot: 12,
+    service_account: 13
   }.with_indifferent_access.freeze
 
   BOT_USER_TYPES = %w[
@@ -28,9 +29,12 @@ module HasUserType
     automation_bot
     admin_bot
     suggested_reviewers_bot
+    service_account
   ].freeze
 
-  NON_INTERNAL_USER_TYPES = %w[human project_bot service_user].freeze
+  # `service_account` allows instance/namespaces to configure a user for external integrations/automations
+  # `service_user` is an internal, `gitlab-com`-specific user type for integrations like suggested reviewers
+  NON_INTERNAL_USER_TYPES = %w[human project_bot service_user service_account].freeze
   INTERNAL_USER_TYPES = (USER_TYPES.keys - NON_INTERNAL_USER_TYPES).freeze
 
   included do
@@ -53,10 +57,8 @@ module HasUserType
     BOT_USER_TYPES.include?(user_type)
   end
 
-  # The explicit check for project_bot will be removed with Bot Categorization
-  # Ref: https://gitlab.com/gitlab-org/gitlab/-/issues/213945
   def internal?
-    ghost? || (bot? && !project_bot?)
+    INTERNAL_USER_TYPES.include?(user_type)
   end
 
   def redacted_name(viewing_user)
diff --git a/app/models/namespace.rb b/app/models/namespace.rb
index 9d9b09e3562..c3bff24cb1a 100644
--- a/app/models/namespace.rb
+++ b/app/models/namespace.rb
@@ -479,9 +479,13 @@ class Namespace < ApplicationRecord
             end
 
     Pages::VirtualDomain.new(
-      projects: all_projects_with_pages.includes(:route, :project_feature, pages_metadatum: :pages_deployment),
       trim_prefix: full_path,
-      cache: cache
+      cache: cache,
+      projects: all_projects_with_pages.includes(
+        :route,
+        :project_setting,
+        :project_feature,
+        pages_metadatum: :pages_deployment)
     )
   end
 
diff --git a/app/models/project.rb b/app/models/project.rb
index 43ec26be786..1909ed8dfdd 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -2116,14 +2116,9 @@ class Project < ApplicationRecord
     pages_metadatum&.deployed?
   end
 
-  def pages_namespace_url
-    # The host in URL always needs to be downcased
-    Gitlab.config.pages.url.sub(%r{^https?://}) do |prefix|
-      "#{prefix}#{pages_subdomain}."
-    end.downcase
-  end
-
   def pages_url
+    return pages_unique_url if pages_unique_domain_enabled?
+
     url = pages_namespace_url
     url_path = full_path.partition('/').last
     namespace_url = "#{Settings.pages.protocol}://#{url_path}".downcase
@@ -2141,6 +2136,14 @@ class Project < ApplicationRecord
     "#{url}/#{url_path}"
   end
 
+  def pages_unique_url
+    pages_url_for(project_setting.pages_unique_domain)
+  end
+
+  def pages_namespace_url
+    pages_url_for(pages_subdomain)
+  end
+
   def pages_subdomain
     full_path.partition('/').first
   end
@@ -3121,6 +3124,18 @@ class Project < ApplicationRecord
 
   private
 
+  def pages_unique_domain_enabled?
+    Feature.enabled?(:pages_unique_domain) &&
+      project_setting.pages_unique_domain_enabled?
+  end
+
+  def pages_url_for(domain)
+    # The host in URL always needs to be downcased
+    Gitlab.config.pages.url.sub(%r{^https?://}) do |prefix|
+      "#{prefix}#{domain}."
+    end.downcase
+  end
+
   # overridden in EE
   def project_group_links_with_preload
     project_group_links
diff --git a/app/models/project_setting.rb b/app/models/project_setting.rb
index db86bb5e1fb..379b94b3af5 100644
--- a/app/models/project_setting.rb
+++ b/app/models/project_setting.rb
@@ -25,6 +25,10 @@ class ProjectSetting < ApplicationRecord
   validates :target_platforms, inclusion: { in: ALLOWED_TARGET_PLATFORMS }
   validates :suggested_reviewers_enabled, inclusion: { in: [true, false] }
 
+  validates :pages_unique_domain,
+    uniqueness: { if: -> { pages_unique_domain.present? } },
+    presence: { if: :require_unique_domain? }
+
   validate :validates_mr_default_target_self
 
   attribute :legacy_open_source_license_available, default: -> do
@@ -68,6 +72,11 @@ class ProjectSetting < ApplicationRecord
       errors.add :mr_default_target_self, _('This setting is allowed for forked projects only')
     end
   end
+
+  def require_unique_domain?
+    pages_unique_domain_enabled ||
+      pages_unique_domain_in_database.present?
+  end
 end
 
 ProjectSetting.prepend_mod